{"id":"CVE-2026-122220","kind":"vulnerability","aliases":["CVE-2026-122220"],"related":[],"title":"WordPress WPO365 Login plugin: captured SAML login replayable to gain access","description":"WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.","summary":"The WPO365 | LOGIN WordPress plugin before version 45.2 fails to record SAML message IDs, so its replay check never fires. An attacker who captures a valid SAMLResponse can replay it within the assertion validity window and log in as the victim, including administrators.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-365","package","saml-sso","wordpress","wpo365-login"],"not_affected_if":["plugin-version-45.2-or-later","saml-login-not-used"],"how_to_check":"- Check the installed version of the `wpo365-login` plugin in the WordPress admin plugins list or `wp plugin get wpo365-login --field=version`.\n- Confirm whether single sign-on through SAML is enabled for the site.","fix":"- WPO365 | LOGIN `45.2` or later (per the NVD description: before version 45.2 is affected).","status":"open","published_at":"2026-11-04T20:19:12+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","triaged_at":"2026-11-04T20:29:56+00:00","updated_at":"2026-11-04T20:29:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T20:29:56Z","model":"claude-haiku-5-5","output":{"fix":"- WPO365 | LOGIN `45.2` or later (per the NVD description: before version 45.2 is affected).","reach":"internet","title":"WordPress WPO365 Login plugin: captured SAML login replayable to gain access","impact":"high","summary":"The WPO365 | LOGIN WordPress plugin before version 45.2 fails to record SAML message IDs, so its replay check never fires. An attacker who captures a valid SAMLResponse can replay it within the assertion validity window and log in as the victim, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpo365-login","saml-sso","microsoft-365"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as any user, including administrators, by replaying captured SAML response","analyst_note":"Confirm the fix version and whether the vulnerable setting is default; check the vulncheck advisory linked in the sources.","how_to_check":"- Check the installed version of the `wpo365-login` plugin in the WordPress admin plugins list or `wp plugin get wpo365-login --field=version`.\n- Confirm whether single sign-on through SAML is enabled for the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-version-45.2-or-later","saml-login-not-used"],"who_is_affected":"Sites running the WPO365 | LOGIN plugin older than 45.2 with SAML single sign-on enabled are exposed. An attacker must capture a valid signed SAML response, which the description says is possible, so sites without SAML login in use can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000729,"input_tokens":4252,"output_tokens":608,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-122220':14A,17A '-2026':13A,16A '-365':19B '45.2':35B,79C 'ac':141C 'access':11A 'administr':70B,156C 'anti':96C 'anti-replay':95C 'assert':60B,146C 'attack':49B,128C 'authent':82C 'bypass':83C 'captur':5A,51B,86C,130C 'capture-replay':85C 'caus':89C 'check':45B,98C,102C,164C 'contain':80C 'cve':12A,15A 'detect':158C 'due':119C 'duplic':161C 'endpoint':142C 'error':123C 'fail':36B 'fire':47B 'function':94C 'gain':10A 'id':41B,104C,111C,117C,163C 'includ':69B,155C 'log':64B,150C 'logic':122C 'login':3A,7A,27B,30B,72C,75C 'messag':40B,103C,110C,116C,162C 'microsoft':18B 'never':46B,106C,165C 'non':93C 'non-funct':92C 'packag':20B 'persist':107C 'plugin':4A,32B,76C 'process':108C 'record':38B 'repeat':143C 'replay':8A,44B,56B,87C,97C,137C 'return':125C 'saml':6A,22B,39B,109C,115C 'saml-sso':21B 'saml2':100C 'samlrespons':54B,135C 'save':127C 'servic':101C 'sign':134C 'sinc':159C 'sso':23B 'transient':118C 'trigger':166C 'valid':53B,61B,133C,147C 'validly-sign':132C 'version':34B,78C 'victim':68B,154C 'vulner':88C 'window':62B,148C 'within':58B,144C 'without':157C 'wordpress':1A,24B,31B 'wpo365':2A,26B,29B,71C,74C,114C 'wpo365-login':25B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPO365 | LOGIN plugin older than 45.2 with SAML single sign-on enabled are exposed. An attacker must capture a valid signed SAML response, which the description says is possible, so sites without SAML login in use can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","microsoft365","package","samlsso","wordpress","wpo365login"],"campaign_type":null,"first_public_at":"2026-11-04T20:19:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122220","severity":null,"published_at":"2026-11-04T20:19:12+00:00","modified_at":"2026-11-04T20:19:12+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","fetched_at":"2026-11-04T20:29:03+00:00","note":null}],"documents":[{"id":70207,"url":"https://www.vulncheck.com/advisories/wpo365-login-before-saml-replay-protection-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}